Does FreeIPA cost less than Active Directory in practice?
FreeIPA carries no license fee: it is GPL-3.0-or-later and has no paid edition of its own. Active Directory runs on Windows Server, which Microsoft licenses per core with a minimum of 16 cores per server and 8 per processor, and both Standard and Datacenter editions also need a Client Access License for every user or device that accesses the server. So the license line favors FreeIPA, but the license line is rarely the whole bill. The real comparison is total cost of ownership, and it turns on how many replicas you run in each datacenter, who operates them, what migration costs and what support you buy.
On the Windows side, count every domain controller, not just the primary pair, because each one needs Windows Server licenses on its cores. Microsoft's pricing page lists suggested prices for 16 core licenses, and notes that prices vary by region and that Azure Arc offers pay-as-you-go licensing. On the FreeIPA side, the recurring costs are staff time and optional support. FreeIPA's deployment recommendations advise at least two to three replicas in each datacenter, dedicated servers and at least one replica running PKI or DNS if you use them, so replica count is a planning decision that affects both sides of the comparison. Ask your Microsoft reseller or licensing advisor for a quote covering your exact core and CAL counts, and ask whether your Enrollment or Software Assurance terms change them.
How the cost components compare for FreeIPA and Active Directory
This table breaks total cost of ownership into the components a buyer pays for, showing who is paid, whether each cost is one-time or recurring, and what drives it up. Read the Active Directory column using the supplied Windows Server 2025 list prices, and treat every figure as a starting point to confirm with Microsoft or a reseller, since regional pricing and agreements change the result.
| Cost component | FreeIPA | Active Directory |
|---|---|---|
| Software license | No license fee. FreeIPA is GPL-3.0-or-later with no paid edition of its own. | Windows Server licensed per core, with a minimum of 16 cores per server and 8 per processor. Confirm the agreement that applies to your estate. |
| Client access licensing | No client access license. Users and hosts are not licensed per seat to FreeIPA. | Standard and Datacenter both need a Windows Server CAL for every user or device that accesses the server. Confirm the CAL count with Microsoft or a reseller. |
| Server operating system | Runs on Linux distributions that package FreeIPA, such as Fedora, Debian, CentOS or RHEL as Identity Management. OS subscription terms depend on your distribution choice. | Windows Server 2025 list price is 1,176 US dollars (Standard) and 6,771 US dollars (Datacenter) for 16 core licenses, per Microsoft's pricing page. Prices vary by region. |
| Pay-as-you-go option | Not applicable. There is no metered license to Microsoft or any FreeIPA licensor. | Azure Arc pay-as-you-go is listed at 33.58 US dollars per core per month in Microsoft's pricing page. Ask whether it applies to on-premises domain controllers in your scenario. |
| Domain controller or replica count | Deployment guidance suggests at least two to three replicas in each datacenter, with no more than four replication agreements per replica. Each replica is a server to host and patch. | Every domain controller replicates the directory for its domain, so count is driven by sites, availability targets and workload. Confirm sizing with your Microsoft partner. |
| Hardware or cloud hosting | Dedicated servers recommended without other applications. Hosting cost is your own infrastructure or cloud instances. | Dedicated domain controllers are also typical. Hosting cost is your own infrastructure or cloud instances, with the same replica count question. |
| Migration effort | Users and groups can be migrated with ipa migrate-ds, but sudo and HBAC rules need manual migration. Budget internal or partner time for policy rework. | Adding Linux hosts usually needs third-party tools or Kerberos realm configuration, as Microsoft notes. Estimate the effort with your team or a partner before comparing totals. |
| Training and skills | Staff need Linux, Kerberos, LDAP and certificate skills. Confirm whether your team already runs these. | Staff need Windows Server, Group Policy and AD operations skills. Confirm whether your team already runs these. |
| Support | Community support is free. Red Hat Identity Management on RHEL comes with vendor support through a subscription. Ask a partner for a written scope. | Support sits under the Microsoft agreement and any partner contract. Confirm the support tier and what it covers in your agreement. |
What moves the cost up or down
Most of the difference between FreeIPA and Active Directory cost comes from how many servers you run, how many cores they carry, how many people use them and what your team already knows. Each driver below pushes the total in a specific direction, and each one is worth pricing against your own estate before you compare quotes or license lines.
Domain controller and replica count
FreeIPA's deployment recommendations advise at least two to three replicas in each datacenter, with no more than four replication agreements per replica. Active Directory replicates directory data to every domain controller in a domain, so each added controller adds Windows licensing and patching work. Count servers per site, then multiply by the cores on each one. Ask your integrator to show the replica layout in the written scope, including which sites run the certificate authority and DNS roles.
Core count per server
Windows Server 2025 is licensed per core, with a minimum of 16 cores per server and 8 per processor. A small domain controller with few physical cores still pays for 16 core licenses, so the minimum drives cost up on lightly loaded servers. FreeIPA runs on Linux and carries no per-core fee, so its cost is in hardware, support and staff time. Check whether your virtualization platform or Azure Arc billing changes the core count you pay for.
User and device count against CALs
Both Windows Server 2025 editions need a Windows Server Client Access License for every user or device that accesses the server. Cost therefore rises with headcount and device count, not with the number of servers. FreeIPA has no client access license, so growth in users adds cost only through support and hardware. Confirm with Microsoft or your reseller whether your users and devices fall under user or device CALs, and which of them are already covered by existing agreements.
Staff skill with Linux versus Windows
The cost of running either directory is largely the cost of the people operating it. A team that already administers Windows domains and Group Policy will spend less time learning Active Directory, while a Linux operations team will find FreeIPA's Kerberos, certificate and DNS components familiar. Skill gaps show up as external support hours, slower incident response and longer upgrade cycles. Ask the implementer to name the staff hours assumed in the scope, and whether training is included or billed separately.
Existing Windows estate and Group Policy dependence
If your domain-joined Windows desktops and servers depend on Group Policy, replacing Active Directory is a large project. Microsoft's comparison notes that Linux machines need third-party tools or Kerberos realm configuration to authenticate against Active Directory, and that Group Policy manages Windows devices. Keeping Active Directory and adding FreeIPA with a cross-forest trust avoids that rebuild but adds a second directory to run. Price the option you intend to take, not only the replacement scenario.
Migration scope and manual rules
FreeIPA's migration how-to supports moving users and groups from other LDAP servers with the ipa migrate-ds command, but sudo and HBAC rules need manual migration through LDIF. Kerberos attributes are regenerated rather than copied. Every sudo rule and host-based access rule you must rewrite adds engineering and testing hours that grow with the policy count. Ask for an inventory of sudo and HBAC rules before scoping, and treat that inventory as the main variable in the migration quote.
Where the licence savings go in FreeIPA
Removing the Windows Server license line does not remove the cost of running the directory. It moves that money into skilled operations. FreeIPA carries no license fee, but the team running it still needs people who understand 389 Directory Server, MIT Kerberos, the Dogtag certificate authority and SSSD on clients. The FreeIPA deployment recommendations advise dedicated servers without other applications, at least two to three replicas in each datacenter, and at least one replica per datacenter running PKI or DNS if those services are used. Each of those choices adds hardware or virtual machines, monitoring and patching. Ask your integrator or internal team to price the server count, the replica layout and the on-call model as separate line items, because they recur every year, unlike a one-time implementation.
Backup and certificate upkeep are the two operating tasks most often underestimated. FreeIPA provides ipa-backup and ipa-restore, with full or online data-only backups, but the backup documentation warns that restoring an outdated backup into an active replica topology can break replication. Restore testing therefore belongs in the run budget, not only in the project plan. The same documentation notes that the first server handles certificate renewal and CRL publication by default, so the team must know which server holds that role and how it fails over. Confirm with your own engineers how often restore drills will run and who signs off on them.
Upgrade budgets also depend on the Windows side of the comparison, so the figures should be read against the Active Directory lifecycle. Windows Server 2025 has mainstream support until November 14, 2029 and extended support until November 15, 2034, according to Microsoft's lifecycle page. Windows Server 2022 mainstream support ended on October 14, 2026, with extended support ending October 15, 2031. Both platforms carry operating cost, so a fair estimate depends on your own staffing, the Linux and Windows skills you already hold, and how many domain controllers and replicas your architecture requires. Microsoft's Windows Server 2025 lifecycle page is the right place to check dates before you build the upgrade calendar.
How to build a cost comparison for your own estate
This sequence turns a rough sense of Active Directory spend into a like-for-like model that puts Microsoft licensing, FreeIPA replica hardware and staff time side by side over a multi-year horizon. The output is a worksheet your finance, security and infrastructure leads can all check against written quotes.
Inventory users, devices, sites and domain controllers
Start by listing every identity-dependent population: user accounts, devices joined to the domain, Linux and UNIX hosts that authenticate to it, and the sites or datacenters that host them. For each current domain controller, record the hostname, site, role (such as PDC emulator or DNS), operating system version and whether it also runs other workloads. Owner: the identity or Windows infrastructure lead, with help from the Linux platform team for non-Windows hosts. Done when every domain controller and every site is on one sheet and the user and device counts come from directory reports, not estimates.
Count cores per server and map to licensing
For each domain controller, record physical or virtual core counts and the processor count. Windows Server 2025 is licensed per core, with a minimum of 16 cores per server and 8 per processor, so small servers still bill for the minimum. Map each server to the core licenses it needs, then check whether virtualization or hosting arrangements change the count. Owner: the infrastructure team, with the Microsoft licensing or procurement contact confirming the rules. Done when every server has a licensed core count and a short note on any virtualization assumptions.
List CAL holders by user and device
Both Windows Server 2025 Standard and Datacenter editions need a Windows Server Client Access License for every user or device that accesses the server. Count named users and devices separately, identify shared or kiosk devices, and note any service accounts or non-human access paths your licensing review considers relevant. Owner: the licensing or IT asset manager. Done when you have one CAL count per access model and a list of the assumptions your licensing advisor needs to confirm.
Define the FreeIPA replica layout per datacenter
Use the FreeIPA deployment recommendations as the starting point for the replica design. The guidance is at least two to three replicas in each datacenter, no more than four replication agreements per replica, at least one replica per datacenter running PKI or DNS if you use them, and dedicated servers without other applications. Draw the topology for each site, count the servers and the virtual machines or hardware each one needs, and note where you would run backups. Owner: the platform engineering lead. Done when you have a replica diagram, a server count per site and a list of the hardware or cloud instances each server requires.
Price staff time for operations, migration and training
Staff time is usually the largest and least visible cost in an identity move. Estimate hours or full-time share for running FreeIPA (replica maintenance, ipa-backup testing, certificate renewal checks, upgrades), for migrating users, groups, sudo rules and host-based access rules (the migration how-to notes that sudo and HBAC rules need manual migration through LDIF), and for training Linux administrators on Kerberos and the directory. Use your own internal rates. Owner: the head of IT with the team leads. Done when each activity has an hours figure, a named owner and a note on whether it is one-time or recurring.
Request written quotes for Microsoft and any services scope
Ask your Microsoft reseller or licensing partner for a written quote that matches your core and CAL counts, and confirm current pricing and regional terms directly with Microsoft, because list prices vary by region and change over time. The Windows Server 2025 pricing page gives a suggested price for 16 core licenses, but that figure is a starting point, not your contract price. Separately, request a fixed-scope written quote from any implementation, support or training provider, specifying deliverables, exclusions and who handles migration testing. Owner: procurement, with the security lead reviewing scope. Done when every cost line in the model traces to a written quote or to an internal rate.
Model a three to five year view with lifecycle dates
Build a year-by-year model covering one-time costs (migration, hardware, training, initial licensing) and recurring costs (core and CAL renewals, support, staff time, hosting). Mark the lifecycle dates that affect timing: Windows Server 2025 mainstream support ends November 14, 2029 and extended support ends November 15, 2034, and Windows Server 2022 extended support ends October 15, 2031, according to the Microsoft Lifecycle page. Run the model with your current domain controllers, then with the planned FreeIPA layout, and compare totals with and without a cross-forest trust. Owner: finance partner with the identity lead. Done when the model shows both scenarios, every assumption is written beside its source, and the Microsoft pricing figures are marked as subject to confirmation.
Which cost factors dominate for each team
When most hosts run Linux and few Windows clients need a domain, the largest cost in FreeIPA is staff time rather than licensing, since the GPL-3.0 code carries no license fee. Active Directory would still bring Windows Server core licenses and client access licenses for every user or device that reaches the server, so those lines are the ones to compare. The effort to build and operate the topology is the other major line.
- Licensing lines: FreeIPA has no license fee, while Windows Server 2025 is licensed per core with a 16-core minimum per server and needs a Client Access License for each user or device.
- Replica count: The FreeIPA deployment recommendations suggest at least two to three replicas in each datacenter, so budget for that many servers and their patching, backup and monitoring.
- Skills: Plan for staff who can run 389 Directory Server, Kerberos and the Dogtag CA, which is usually a recurring cost rather than a one-time one.
- Migration of host policy: Sudo and HBAC rules need manual migration through LDIF, so this effort is one-time but can be large for many hosts.
- Support: FreeIPA is a community project with no paid edition, so ask whether you need a vendor support agreement from a distribution or a third party.
Ask for a quote that lists replica counts, the expected sudo and HBAC rule migration effort, and who carries on-call duty for the directory.
When Windows users must keep signing in to the domain and Linux resources must accept those same identities, the cost picture changes. Active Directory stays in place, FreeIPA is added for Linux, and a cross-forest trust links the two. The trust itself carries little license cost, but you keep paying for the Windows domain controllers and their client access licenses while adding the FreeIPA servers.
- Dual operation: Two directories mean two sets of replicas, patch cycles and backup procedures, which recur every year.
- Trust setup: FreeIPA can establish a cross-forest trust with an AD domain on Windows Server 2008 R2 or later, which is a one-time engineering task with an ongoing review cost.
- DNS planning: The IPA DNS domain must not overlap with any domain in the AD forest, so naming decisions made at install time affect cost if they must be changed later.
- Windows Server lifecycle: Windows Server 2022 mainstream support ended on October 14, 2026 and its extended support ends on October 15, 2031, so plan any domain controller refresh against those dates.
- Coexistence versus replacement: If the trust means you keep both directories indefinitely, the combined run cost may exceed a single-directory design, so model both paths.
Check with the vendor the current Client Access License terms for your user count, and ask your implementation partner to estimate trust maintenance as a recurring line.
Where Group Policy is central to desktop and server management, Active Directory usually remains the simpler and often cheaper path. FreeIPA does not replace Group Policy for Windows desktops, and Linux machines need their own configuration management. Replacing Group Policy means rebuilding those controls elsewhere, and that rebuild is the cost line that dominates this scenario.
- Rebuild effort: Each Group Policy object you need to reproduce must be re-expressed in another tool, which is a one-time cost that scales with the number of policies.
- Domain join: Active Directory lets administrators domain-join Windows devices, while Linux machines need third-party tools or Kerberos realm configuration, so Windows device management stays on the AD side.
- Retained licensing: Even if Linux takes the directory role, you may still need Windows Server licenses for Group Policy hosts, so the saving is smaller than a simple license comparison suggests.
- Training: Staff familiar with Group Policy may need training on a different administration model, which is a one-time cost with recurring risk if turnover is high.
- Lifecycle timing: Windows Server 2025 mainstream support ends on November 14, 2029, which gives a planning date for any refresh.
Before comparing totals, ask for a written inventory of Group Policy objects and the Windows features they control, because that inventory sets the rebuild effort.
Questions buyers ask about FreeIPA and Active Directory costs
Does FreeIPA have any license fee?
No. FreeIPA is licensed under GPL-3.0-or-later and is a community project with no paid edition of its own, according to its COPYING file. The software cost is zero, but the total cost is not. You still pay for the servers or virtual machines it runs on, for the staff who operate it, for any support subscription you buy from a vendor, and for any outside services you engage. If you want a vendor-backed build, Red Hat's Identity Management on RHEL is a separate, supported product with its own subscription, so confirm that cost before comparing totals.
What does Active Directory licensing actually charge for?
Windows Server 2025 is licensed per core, with a minimum of 16 cores per server and 8 per processor. Both Standard and Datacenter editions also need a Windows Server Client Access License for every user or device that accesses the server. Microsoft's pricing page lists a suggested price of 1,176 US dollars for Standard and 6,771 US dollars for Datacenter for 16 core licenses, and notes that prices vary by region. Pay-as-you-go through Azure Arc is listed at 33.58 US dollars per core per month. Ask your reseller for the price in your region and for the CAL count your user and device population requires.
How many domain controllers or FreeIPA replicas do I need?
The count depends on your sites, user load and recovery goals, not on a license. FreeIPA's deployment recommendations advise at least two to three replicas in each datacenter, no more than four replication agreements per replica, dedicated servers without other applications, and at least one replica per datacenter running PKI or DNS if you use them. Active Directory replicates directory data to every domain controller in a domain, so each DC adds Windows Server core licensing and CALs are counted per user or device, not per server. Model both topologies with your own site list and confirm the count in the design phase.
What does a migration from Active Directory to FreeIPA involve, and what needs manual work?
Most organizations keep Active Directory and add FreeIPA alongside it through a cross-forest trust rather than replacing it outright. For a full move, FreeIPA's migration how-to describes the ipa migrate-ds command for users and groups from other LDAP servers, which excludes Kerberos attributes that FreeIPA regenerates. Sudo and HBAC rules need manual migration through LDIF. Group Policy settings, application logins that depend on Windows-integrated authentication, and device management all need a separate plan. Your effort rises with the number of applications and policies you must rebuild, so inventory those first.
What training and support skills do my staff need?
Your team needs Linux administration, Kerberos and LDAP basics, DNS, certificate lifecycle management and replication troubleshooting. FreeIPA's backup documentation warns that restoring an outdated backup into an active replica topology can break replication, and that the first server handles certificate renewal and CRL publication by default, so operators need that knowledge before an incident. Active Directory administrators already know much of the directory model, but Linux host integration usually needs new skills. Budget training time, and ask any vendor or partner whether support covers FreeIPA on your distribution and at what response level.
Can my team run FreeIPA without outside help?
It depends on your Linux and identity skills, your change control, and how much of the estate you plan to move. A team with experienced Linux and directory operators can run FreeIPA with the public documentation, but it still needs tested backups, a replica topology and a tested restore procedure. Teams without those skills often engage outside help for design, migration and hardening. DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted platforms in your own infrastructure, typically under a fixed-scope agreement. Ask for the written scope before deciding which parts to keep in house.
How long does the work take?
Duration depends on scope, including the number of sites, users, applications, policies and trusts involved, and on how much of the work your team can take on. No duration is given here because the supplied facts do not establish one. DeployOpen agrees timelines in writing as part of a fixed-scope engagement before work starts, and ongoing support and upgrades are available as retainers. Ask for a phased plan that separates the trust and pilot work from the full cutover.
How DeployOpen helps you compare and implement
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For FreeIPA vs Active Directory cost, we start by writing down the environment, the licensing and the staffing assumptions so the comparison reflects your estate rather than a generic model.
How we scope
- We inventory your Windows Server, domain controller and client counts before any cost comparison is drawn.
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We set out which replica counts, trust designs and migration waves the written scope covers, and which it leaves out.
How we build
- We build a side-by-side cost model covering licenses, hardware, staff time, training and migration effort.
- We test a FreeIPA proof of concept against a representative set of Linux hosts and AD user flows.
- We document each assumption so your finance and security teams can change inputs and rerun the model.
How we hand over
- You receive the cost model, architecture notes, runbooks for replicas and backups, and the migration plan.
- We walk your operations staff through backup, restore and replica procedures so knowledge stays in-house.
- Deliverables are written for your auditors and procurement team, including what each cost line depends on.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- We can revisit the cost model when Windows Server licensing, lifecycle dates or your user counts change.
- DeployOpen prepares evidence for compliance assessments, but independent auditors issue any audit reports or certifications.
